Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
OpenSSH is currently under active attack due to a vulnerability that allows direct access, elevating the situation beyond a typical disclosure.
OpenSSH is under active attack through a flaw that lets someone break into it directly, which moves this well past an ordinary disclosure.
The affected service is reachable from the network without authentication.
OpenSSH may already be doing an ordinary job in your environment while also being reachable from a network an attacker can access.
This isn't a 'patch when convenient' advisory anymore -- attackers got there first.
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian .
The issue, discovered by security researcher Ozgun Kultekin, has been addressed in OpenSSH 10.6p2 .
Anyone running OpenSSH 3.18.11 through 3.24.3 is exposed, and because this is reachable without authentication, exposure doesn't depend on a user doing anything.
The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled, including Alpine Linux's default OpenSSH server configuration.
An unauthenticated attacker can supply an oversized password to access accounts that are deliberately configured without usable passwords, without having to steal credentials or SSH keys.
What an attacker actually gains: the advisory describes a real security impact once the vulnerable path is reached.
Being reachable without authentication is what moves this from 'patch eventually' to 'patch now' -- there's no login screen standing between an attacker and the vulnerable code.
An attacker can trigger the vulnerability to authenticate to certain password-disabled accounts using an arbitrary password between 257 and 1,024 bytes long, causing the hash attempt to fail and returning an asterisk.
This is tracked as CVE-2026-123158 and rated critical severity, which is the identifier to use when checking vendor guidance.
The affected versions are 3.18.11 through 3.24.3, so that's the range to check against your own deployment.
The underlying issue dates back to a patch introduced in 2016 to fix a username enumeration vulnerability tracked as CVE-2016-6210 .
A workaround exists, but there is no complete fix available yet.
Under specific conditions, the password-handling behavior in OpenSSH mistakenly interprets a failed password-hashing operation as successful authentication by producing the same value (*) used to indicate that an account with password disabled at the system level.
It's worth noting that the vulnerability does not affect Dropbear, glibc-based Linux distributions, non-Linux systems, and systems that check passwords through PAM.
Confirm whether OpenSSH 3.18.11 through 3.24.3 is present anywhere in your asset and software inventory.
Treat exposed matches as urgent -- exploitation has already been reported.
Affected users are advised to install OpenSSH 10.6p2 or their distribution's patched package, and then restart sshd.
What happened
OpenSSH is currently under active attack due to a vulnerability that allows direct access, elevating the situation beyond a typical disclosure.
The affected service can be accessed over the network without requiring authentication.
OpenSSH may be functioning normally in your environment while still being accessible from a network that attackers can reach.
What changed
This is no longer a 'patch when convenient' advisory -- attackers have already taken action.
Threat actors are attempting to exploit a newly disclosed security flaw in OpenSSH that enables sign-ins to accounts lacking password protection, as reported by Previdian.
The issue, identified by security researcher Ozgun Kultekin, has been addressed in OpenSSH 10.6p2.
Who is affected
Anyone using OpenSSH versions 3.18.11 through 3.24.3 is at risk, and since this flaw is accessible without authentication, exposure does not require user interaction.
The vulnerability, designated as CVE-2026-123158 (CVSS score: 8.1) and referred to as SSHole (or *sshole), affects Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled, including the default OpenSSH server configuration of Alpine Linux.
An unauthenticated attacker can exploit this vulnerability by supplying an oversized password to access accounts that are intentionally configured without usable passwords, circumventing the need to steal credentials or SSH keys.
Why it matters
The advisory outlines the tangible security risks that arise once the vulnerable path is exploited.
The ability to access the service without authentication shifts the urgency from 'patch eventually' to 'patch now' -- there is no login screen to hinder an attacker's access to the vulnerable code.
An attacker can exploit the vulnerability to authenticate to specific accounts that are password-disabled by using an arbitrary password ranging from 257 to 1,024 bytes, leading to a failed hash attempt that returns an asterisk.
Technical details
This vulnerability is tracked as CVE-2026-123158 and rated with critical severity, which is the reference to consult for vendor guidance.
The affected versions are 3.18.11 through 3.24.3, so this range should be verified against your deployment.
The underlying issue stems from a patch implemented in 2016 to address a username enumeration vulnerability tracked as CVE-2016-6210.
Response
A workaround is available, but a complete fix has not yet been released.
Under certain conditions, the password-handling behavior in OpenSSH incorrectly interprets a failed password-hashing operation as a successful authentication by returning the same value (*) that indicates an account has password protection disabled at the system level.
It is important to note that this vulnerability does not impact Dropbear, glibc-based Linux distributions, non-Linux systems, or systems that validate passwords through PAM.
What security teams should do
Verify if OpenSSH versions 3.18.11 through 3.24.3 are present in your asset and software inventory.
Treat any exposed instances as urgent, as exploitation has already been reported.
Affected users are recommended to upgrade to OpenSSH 10.6p2 or install the patched package provided by their distribution, followed by restarting sshd.